Model Validation Analyst Job Description

A Model Validation Analyst is the person a bank pays to distrust its own models. Credit scorecards, probability-of-default and loss-given-default models, CECL reserve forecasts, capital stress tests, interest rate risk models, derivative pricing libraries and anti-money laundering transaction monitoring all produce numbers that drive real decisions. The validation analyst's job is to decide whether those numbers can be relied on, for which uses, and with what limits, before and after a model goes live.

The interagency guidance the Federal Reserve, OCC and FDIC issued on April 17, 2026 defines a model as "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates." It excludes simple spreadsheet arithmetic and deterministic rule-based software, so part of the work is arguing about what belongs in the model inventory in the first place.

Validation itself follows a familiar structure. The guidance names three components. Conceptual soundness means reading the development documentation and testing "key modeling choices, assumptions, qualitative judgments, and data selection." Outcomes analysis compares model outputs with real-world results, including back-testing and outlier analysis. Ongoing monitoring checks whether a model still performs as products, clients, data and market conditions shift. In practice an analyst might rebuild a developer's logistic regression in Python, rerun it on an out-of-time sample, swap in a challenger gradient-boosted model to see whether the champion is leaving accuracy on the table, and stress the key drivers until the output stops making sense.

The deliverable is a validation report: a rating, a list of findings ranked by severity, documented limitations and the conditions of use. Developers answer each finding, and the analyst tracks remediation. Validation generally happens before first use, but the guidance allows urgent use before validation is finished, with tighter limits and closer monitoring, and the analyst often helps set those limits.

The role is defined by its independence. The guidance describes "effective challenge" as critical analysis by people with the expertise, independence and "organizational standing and influence to effect any change." Validators work across from model developers in the first line, alongside model owners and business users, and report findings to a model risk committee. Internal audit, under the guidance, generally does not duplicate validation; it checks whether the model risk program itself works. Bank examiners review validation files during supervisory exams.

Vendor models add a twist. The guidance points to "the widespread use of customized vendor and other third-party products," including complete models whose code a bank may never receive, and says the principles still apply, so the analyst asks the vendor for methodology and development data and builds outcomes tests around the black box.

This is not a job building trading strategies or writing the firm's enterprise AI policy. A validator rarely owns a model and never sets the bank's risk appetite; the output is a documented, defensible opinion on someone else's work.

Model validation is a quantitative job with a heavy writing load, and the work demands both. As a rough guide, entry-level analysts arrive with a degree in statistics, mathematics, economics, financial engineering, physics, operations research or computer science, and validating complex pricing or stress-testing models typically calls for a master's degree or PhD.

ONET files Model Validation Analyst, along with related titles such as Quantitative Model Validation Analyst and Model Risk Manager, under Financial Quantitative Analysts. Among workers ONET surveyed in that occupation, 60% said a master's degree was required, 35% a bachelor's degree and 5% a doctoral degree.

The technical core is applied statistics and econometrics: regression and classification, time series, survival models, Monte Carlo simulation and, for market risk and pricing work, stochastic calculus and numerical methods. Credit, fraud and AML validation can involve machine learning models, so analysts should be able to interrogate gradient-boosted trees and neural networks, test for overfitting and drift, and use explainability methods such as SHAP values and partial dependence plots. Programming is daily work. O*NET lists SAS and MATLAB among the software for this occupation, and Python, R and SQL are the standard languages for rebuilding a developer's results.

Domain knowledge matters as much as math. A validator reviewing a CECL model needs to understand loan accounting; one reviewing a value-at-risk engine needs to understand the trading book; one reviewing a transaction monitoring system needs to understand Bank Secrecy Act alerts and investigations. Routes in include model development, credit risk analytics, data science and quantitative research, and validation work spans models built by many different teams.

Credentials are optional. The ones that map to validation work:

• Financial Risk Manager (FRM), awarded by the Global Association of Risk Professionals (GARP), covers quantitative analysis, valuation and risk models, and market, credit and operational risk.
• Professional Risk Manager (PRM), awarded by the Professional Risk Managers' International Association (PRMIA), is an exam-based risk management designation.
• Chartered Financial Analyst (CFA), awarded by CFA Institute, is useful for validators covering valuation and investment models.

As a rough guide, analysts with two to four years of modeling or validation experience move to senior analyst roles, and those with six or more years lead validations of the bank's most material models or manage validation teams. The soft skills are specific: writing findings that hold up when a business head pushes back, staying calm in front of examiners, and knowing when a weakness is a footnote and when it should stop a model from going live.

BLS does not count model validators separately, so outlook figures come from the two occupations closest to the work. ONET's profile for Financial Quantitative Analysts projects average growth of 3% to 4% from 2025 to 2035, with about 9,400 openings a year on average. For Financial Risk Specialists, ONET projects growth of 7% or higher, which it labels much faster than average, with about 4,800 openings a year on average. BLS counted 63,850 financial risk specialists employed in May 2025.

The bigger story for 2026 is the rulebook. On April 17, 2026 the Federal Reserve issued SR 26-2, jointly with the OCC and FDIC, which supersedes and replaces SR 11-7, the Fed's April 4, 2011 model risk guidance, along with SR 21-8 on Bank Secrecy Act models. The OCC rescinded its matching Bulletin 2011-12 and the "Model Risk Management" booklet of the Comptroller's Handbook.

The new text keeps the core of the job, including effective challenge, conceptual soundness, outcomes analysis and ongoing monitoring, but changes the framing. It is explicitly risk-based and tailored. It is expected to be most relevant to banking organizations with over $30 billion in total assets, and models at banks with $30 billion or less "typically are subject to internal risk management and governance practices" suited to their size. It also states that non-compliance "will not result in supervisory criticism," though a footnote adds that supervisory action may still follow from violations of law or unsafe or unsound practices. And it says the quality of validation "depends on the rigor and effectiveness of the review rather than on organizational structure," which leaves each bank to decide how its validation function is organized.

AI is the other variable. The guidance says its principles apply to traditional statistical models and "non-generative, non-agentic AI models," so machine learning credit and fraud models remain within its scope. Generative AI and agentic AI models, by contrast, "are not within the scope of this guidance." In remarks delivered April 27, 2026 and published May 1, Federal Reserve Vice Chair for Supervision Michelle W. Bowman said that "over time, supervisors expanded the scope of the previous guidance beyond its original purpose to apply it in unintended ways," and asked, "What aspects of model risk management should apply to AI?" The OCC's Spring 2026 Semiannual Risk Perspective said the agencies planned to issue a request for information on model risk management that considers banks' use of AI, including generative and agentic AI.

None of these documents estimates what the narrower scope means for validation headcount. The guidance still describes validation, vendor model review and ongoing monitoring as part of sound practice, and it tells banks that their own risk management and governance practices should guide controls for tools it does not cover. That second instruction is where generative AI lands for now.

Dear Hiring Manager,

I am applying for the Model Validation Analyst position in your Model Risk Management group. For the past three years I have worked as a credit risk model developer at a regional bank, building probability-of-default and loss-given-default models for our commercial real estate and small business portfolios. I want to move to the other side of the table, because the most valuable work I have done so far came from answering a validator's hard questions.

During our last reserve model redevelopment, the validation team challenged my choice of macroeconomic drivers and asked why the model underpredicted losses in one region. Rebuilding the analysis showed that a data mapping change had dropped a set of modified loans from the development sample. Fixing it improved the model, but the lesson stayed with me: a good validator finds the problem the developer cannot see. Since then I have run my own challenger models before every submission, comparing logistic regression against gradient-boosted alternatives in Python and documenting where each one breaks.

I hold a master's degree in applied statistics and passed Part I of the FRM exam this spring. My strengths are replicating results quickly, running out-of-time and sensitivity tests, and writing documentation that a business head and an examiner can both follow. I have presented model results to our risk committee twice and handled follow-up requests from examiners during a supervisory review.

I would bring a developer's understanding of shortcuts and constraints to your validation team, along with the discipline to put findings in writing and hold the line on remediation. I would welcome the chance to discuss how I could support your validation plan for the coming year.

Sincerely, Jordan Ellis